Packman Build Service PMBS

Changes of Revision 21

project.diff Deleted

@@ -1,81 +0,0 @@
---- libde265.changes.orig
-+++ libde265.changes
-@@ -1,4 +1,67 @@
- -------------------------------------------------------------------
-+Thu Sep  3 06:04:55 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>
-+
-+- Update to version 1.1.2:
-+  + This is a security and bugfix release. It is ABI- and
-+    API-compatible with v1.1.1 and is a drop-in replacement. Two
-+    enum values were added: DE265_ERROR_INVALID_ARGUMENT and
-+    DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING.
-+  + Security fixes: (CVE numbers will be added when assigned.)
-+    - CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and
-+      double free in multi-threaded (WPP) decoding. A crafted
-+      stream whose slice segments repeat or rewind their
-+      slice_segment_address within a picture re-ran CTB rows that
-+      were already marked finished, so the CABAC context handoff
-+      between rows was no longer ordered and the shared context
-+      table was released twice. Slice segments that do not follow
-+      the previous one in tile-scan order are now rejected with the
-+      new warning
-+      DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the
-+      WPP row progress is reset for each slice segment. (medium)
-+    - CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free
-+      after de265_reset(): the pointer to the previous slice header
-+      was left dangling when the DPB was cleared, and a dependent
-+      slice pushed after the reset copied from freed memory.
-+      (medium)
-+  + Hardening:
-+    - de265_push_NAL() rejects NAL units shorter than the two-byte
-+      NAL unit header (including negative lengths) with the new
-+      DE265_ERROR_INVALID_ARGUMENT instead of calling memcpy() with
-+      a NULL destination and then aborting the decode
-+    - SEI parsing: the overflow guard on the accumulated
-+      payload_size compared the wrong variable and could never
-+      trigger, so a crafted size could wrap around silently
-+    - The per-CTB progress counters and the image integrity flag
-+      are atomic with acquire/release ordering; ThreadSanitizer
-+      reported data races on them with several worker threads
-+  + Bug fixes:
-+    - Regression since v1.0.17: a cu_qp_delta of -26 was rejected
-+      as out of range although the allowed range is asymmetric and
-+      -26 is valid. Real-world encoders emit this value; the
-+      rejection aborted the slice and corrupted every picture of
-+      the affected IDR period
-+    - Regression since v1.0.17: an out-of-range value in the
-+      advisory VUI fields (bitstream_restriction(),
-+      chroma_sample_loc_type_*) rejected the whole SPS, so HEIF
-+      images from some consumer encoders could not be decoded at
-+      all. These fields are never used in the decoding process;
-+      they are now clamped with a warning as in v1.0.16. Malformed
-+      exp-Golomb codes are still a hard error
-+    - 16-bit decoding: the residual of 4x4 intra luma blocks (DST)
-+      was clipped to 16 bits although it needs 17 bits at bit depth
-+      16, corrupting those blocks and everything intra-predicted
-+      from them. Output is now identical to the HM reference
-+      decoder; bit depths up to 15 were not affected
-+    - MSVC: the visibility attribute is only used with GCC and
-+      Clang, fixing the static build with MSVC
-+    - CMake: building sherlock265 together with the library
-+      silently disabled the hidden symbol visibility introduced in
-+      v1.1.1. sherlock265 only uses exported symbols, so it no
-+      longer forces full visibility, and the configure output now
-+      states why symbols are hidden or exported.
-+      FORCE_FULL_VISIBILITY is documented in the README
-+
-+-------------------------------------------------------------------
- Tue Jun 16 07:40:59 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>
- 
- - Update to version 1.1.1:
---- libde265.spec.orig
-+++ libde265.spec
-@@ -18,7 +18,7 @@
- 
- %define so_ver  0
- Name:           libde265
--Version:        1.1.1
-+Version:        1.1.2
- Release:        0
- Summary:        Open H.265 video codec implementation
- License:        LGPL-3.0-only

_link Changed

libde265-1.1.2.tar.gz Deleted